Privacy Policy
AI Dashboard (“the Dashboard”, “we”, “us”) is a personal productivity workspace with to-do lists, a calendar, goals, notes, finance tracking, and an AI assistant you can talk or type to. It is run by Joe Doroan, an individual, who is the data controller for the information described here. This policy explains what we collect, why, who we share it with, and the choices you have.
1. Who can use the Dashboard
Accounts are created by invitation: you register with a one-time link emailed to you by a member or an administrator. When someone invites you, we store your email address and who invited you, and we send you that one email. The Dashboard is not directed at children, and we do not knowingly provide accounts to anyone under 16.
2. What we collect
Account information
- A username you choose, and a salted bcrypt hash of your password. We never store your password itself.
- Your email address. We use it to send you account emails (confirming the address, resetting a password, a notice when the password changes) and to match an invitation to you. We send these through an email delivery provider (Resend), which receives the address and the message. If you invite someone, we also store their email address, your username as the inviter, and the invitation's status.
- We do not ask for or store your phone number or real name.
- Sign-in session tokens (a short-lived access token and a rotating refresh token).
Content you create
Everything you put into the Dashboard: tasks and lists, calendar events, goals and milestones, notes, finance data (accounts, transactions, budgets, funds), custom AI agents and their results, files you attach, feedback you submit, and your conversations with the AI assistant. This is stored so the Dashboard can show it to you again.
Preferences and device data
- Settings such as theme, accent colour, time zone and which AI model you prefer, stored on our server.
- Window layout and similar interface state, stored in your browser’s local storage.
- Standard server logs (IP address, time, requested path) are produced by our web server and by Cloudflare, which carries traffic to the Dashboard (see Section 5).
Information from services you connect
| Service | What we receive | Why |
|---|---|---|
| Google Calendar | Your calendars and events (titles, times, locations, descriptions, attendees), plus an OAuth token that lets us keep them in sync. | To show Google events in the Dashboard calendar and to create, edit or delete events when you ask. |
| Google Drive | Folder and file metadata (names, types, sizes, modified times, locations, sharing information). File contents are fetched only when you open a file, or when you ask the AI assistant to read or work with one. | To browse, view, upload, organise and manage your Drive files from the Dashboard. |
| Plaid (optional, Finance) | Bank account names and balances and transactions from the institution you choose, plus an access token. | To import transactions into the Finance module. |
We do not receive your bank sign-in credentials; you enter them with Plaid, not with us. We do not receive your Google password; you enter it with Google.
3. How we use your information
- To provide the features above and to keep your data in sync across your devices.
- To run the AI assistant, which acts on your requests (for example, “move my 3pm meeting to Friday”).
- To run automations you set up, such as scheduled tasks and custom agents.
- To secure the service, prevent abuse, diagnose errors, and respond to feedback and support requests.
We do not sell your data, use it for advertising, or build advertising profiles.
4. Google user data
The Dashboard’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, for data we receive from your Google account (Calendar and Drive):
- We use it only to provide and improve the user-facing Calendar and Drive features you see in the Dashboard.
- We do not sell it, use it for advertising, or transfer it to others except as needed to provide those features (see below), to comply with the law, or as part of a merger or sale with notice to you.
- We do not use it to develop, improve or train generalized AI or machine-learning models.
- No person reads your Google data, unless you ask us to for support, it is needed for security or abuse investigation, or the law requires it.
AI features. When you ask the assistant to work with your calendar or Drive, the relevant events or file content are included in the request sent to the AI model you have selected (Section 5). This is done only to answer that request. Each connected Drive account has an “AI access” switch; turn it off and the assistant cannot read or change that account.
Storage. Google OAuth tokens are encrypted before they are stored. Synced calendar events are kept in our database so the calendar loads quickly. For Drive we do not keep copies of your files; we keep folder metadata (names, IDs and locations of folders you have opened) so navigation is fast, and we read file contents live from Google when needed.
Revoking access. Disconnect an account in the Dashboard, and/or remove the Dashboard at myaccount.google.com/permissions. Either stops further access. When you disconnect, we delete the stored tokens and the synced data for that connection.
5. Who we share data with
We share data only with the providers below, and only as needed for the feature in question.
| Provider | Role | Data involved |
|---|---|---|
| Anthropic | AI model (Claude), used when you select the cloud model in Settings. | Your message, recent conversation, and the Dashboard data and tool results needed to answer (which may include calendar events or Drive content). Under Anthropic’s API terms this data is not used to train its models by default. |
| Local model (Ollama) | The default model. Runs on the operator’s own server. | The same as above, but it is not sent to any third party. |
| OpenAI | Speech-to-text, used only if you use voice input. | The audio you record. Under OpenAI’s API terms this data is not used to train its models by default. |
| Calendar and Drive APIs; Google Fonts. | The requests needed to read and change your Calendar and Drive; your browser also fetches the Inter font from Google Fonts, which sees your IP address. | |
| Plaid | Bank connection, only if you link a bank. | The data you authorise Plaid to share with us. |
| Cloudflare | Network proxy and tunnel that delivers the Dashboard over HTTPS. | Traffic to and from the Dashboard passes through Cloudflare. |
We may also disclose information if required by law, or to protect the rights, safety or security of users or the service. Aside from the providers above we do not share your data with anyone.
6. Where data is stored and how it is protected
- Data is stored in a database on the operator’s own server. It is not stored with a cloud database vendor.
- Traffic is encrypted in transit (HTTPS).
- Passwords are hashed; Google, Plaid and other service credentials are encrypted before storage.
- Every request is authenticated, and each account can reach only its own data.
- No system is perfectly secure. If a breach affecting your data occurs, we will notify affected users as the law requires.
The operator administers the server and so has technical access to the database. We access your content only for the reasons given in Section 4 and Section 3.
7. Retention and deletion
- We keep your data while your account exists, so it is there when you come back.
- Files you attach to chats are removed 30 days after the conversation goes quiet.
- You can delete individual items (tasks, notes, events and so on), disconnect Google or Plaid at any time, and remove any file or agent you created.
- To delete your whole account and all its data, email copperdex@gmail.com from the account you want deleted, giving your username. We will delete it within 30 days.
- Backups of the database may still hold deleted data for up to 30 days before they are rotated out.
8. Your choices and rights
You can ask us to access, correct, export or delete the data we hold about you, or to restrict or object to how we use it. Depending on where you live (for example under the GDPR or the California Consumer Privacy Act) you may have specific legal rights to do so; we honour these requests for all users. Email copperdex@gmail.com; we will reply within 30 days. You can also complain to your local data-protection authority.
You can also choose the local model rather than the cloud model in Settings, avoid voice input, skip connecting Google or Plaid, and switch off AI access for a connected Drive account.
9. Cookies and tracking
The Dashboard does not set cookies and has no analytics, advertising or cross-site tracking. It uses your browser’s local storage to keep you signed in and to remember your layout and settings.
10. Changes to this policy
If we change this policy we will update the date above, and for material changes we will tell signed-in users in the Dashboard before they take effect. If we ever want to use Google data for a new purpose we will ask for your consent first.
11. Contact
Questions, requests or complaints: copperdex@gmail.com
Joe Doroan, USA